@ory/mastra 0.13.9 → 1.0.0

package/README.md

@@ -2,8 +2,8 @@
 
 Ory Agent Security for [Mastra](https://mastra.ai).
 
-Authorizes every tool call against Ory Permissions, traces invocations, and propagates
-user → agent → sub-agent identity — built on [`@ory/argus`](../core).
+Authorizes every tool call against Ory Permissions, records invocation activity, and propagates
+user → agent → sub-agent identity — built on [`@ory/argus`](https://www.npmjs.com/package/@ory/argus).
 
 ```bash
 npm install @ory/mastra
@@ -24,9 +24,9 @@ const agent = new Agent({
 });
 ```
 
-`beforeToolCall` authorizes each call; in **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a
+`beforeToolCall` authorizes each call; in **enforce** mode a
 denied tool is skipped via `{ proceed: false, output }` and the model receives the denial. In
-**observe** mode (default) the tool runs and a `permission.observe_deny` span is recorded.
+**observe** mode (default) the tool runs and a `permission.observe_deny` activity event is recorded.
 `afterToolCall` records `tool.complete`.
 
 Alternatively, wrap tool `execute` directly (deny → throw):
@@ -38,5 +38,4 @@ const tools = withOry({ search, sendEmail });
 
 This package depends only on `@ory/argus` — not `@mastra/core`; tools and hook contexts are
 duck-typed so any Mastra v1 version works. Credentials come from the shared
-`~/.config/ory-agent-plugins/config.json`. See
-[docs/sdk-integrations.md](../../docs/sdk-integrations.md).
+`~/.config/ory-agent-plugins/config.json`.

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  *
  *   - {@link oryAgentHooks} (recommended) — agent tool-call hooks for `new Agent({ hooks })`.
  *     `beforeToolCall` authorizes every tool (incl. agent-/workflow-as-tools); a deny returns
- *     `{ proceed: false, output }` so Mastra skips the tool. `afterToolCall` traces completion.
+ *     `{ proceed: false, output }` so Mastra skips the tool. `afterToolCall` records completion activity.
  *   - {@link withOry} — wraps each tool's `execute` directly (deny → throw), for callers who
  *     prefer per-tool wrapping or are on a Mastra version without the hooks API.
  *

package/dist/index.js

@@ -6,7 +6,7 @@
  *
  *   - {@link oryAgentHooks} (recommended) — agent tool-call hooks for `new Agent({ hooks })`.
  *     `beforeToolCall` authorizes every tool (incl. agent-/workflow-as-tools); a deny returns
- *     `{ proceed: false, output }` so Mastra skips the tool. `afterToolCall` traces completion.
+ *     `{ proceed: false, output }` so Mastra skips the tool. `afterToolCall` records completion activity.
  *   - {@link withOry} — wraps each tool's `execute` directly (deny → throw), for callers who
  *     prefer per-tool wrapping or are on a Mastra version without the hooks API.
  *
@@ -18,29 +18,16 @@ exports.oryAgentHooks = oryAgentHooks;
 exports.withOry = withOry;
 const argus_1 = require("@ory/argus");
 const HARNESS = "mastra";
-function lazySession(client, projectUrl) {
-    let sessionPromise;
-    // Cache the in-flight promise (not a boolean) so concurrent first calls all
-    // await the same session start instead of racing past a still-running gate.
-    // Fail-open: a rejection is logged, never rethrown, and clears the cache so
-    // a later call can retry.
-    return () => {
-        sessionPromise ??= (0, argus_1.sessionStart)(client, { harness: HARNESS, projectUrl }).then(() => undefined, (err) => {
-            sessionPromise = undefined;
-            client.logger.warn("session_start.failed", {
-                message: err instanceof Error ? err.message : String(err),
-            });
-        });
-        return sessionPromise;
-    };
-}
 /**
  * Build the `{ beforeToolCall, afterToolCall }` hooks object for `new Agent({ hooks })`.
  */
 function oryAgentHooks(options = {}) {
     const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
     const canBlock = options.canBlock ?? true;
-    const ensureSession = lazySession(client, options.projectUrl);
+    const ensureSession = (0, argus_1.createSessionStarter)(client, {
+        harness: HARNESS,
+        projectUrl: options.projectUrl,
+    });
     return {
         beforeToolCall: async (ctx) => {
             await ensureSession();
@@ -77,7 +64,10 @@ function oryAgentHooks(options = {}) {
 function withOry(tools, options = {}) {
     const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
     const canBlock = options.canBlock ?? true;
-    const ensureSession = lazySession(client, options.projectUrl);
+    const ensureSession = (0, argus_1.createSessionStarter)(client, {
+        harness: HARNESS,
+        projectUrl: options.projectUrl,
+    });
     const wrapped = {};
     for (const [key, tool] of Object.entries(tools)) {
         if (!tool || typeof tool.execute !== "function") {
@@ -103,9 +93,15 @@ function withOry(tools, options = {}) {
                         namespace: result.namespace,
                     });
                 }
-                const output = await originalExecute(inputData, context);
-                (0, argus_1.complete)(client, { toolName, output });
-                return output;
+                try {
+                    const output = await originalExecute(inputData, context);
+                    (0, argus_1.complete)(client, { toolName, output });
+                    return output;
+                }
+                catch (error) {
+                    (0, argus_1.fail)(client, { toolName, input: inputData, error });
+                    throw error;
+                }
             },
         };
     }

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "@ory/mastra",
-  "version": "0.13.9",
-  "description": "Ory Agent Security for Mastra — per-tool authorization, tracing, and identity propagation via agent tool-call hooks (or wrapping tool execute). Built on @ory/argus.",
+  "version": "1.0.0",
+  "description": "Ory Agent Security for Mastra — per-tool authorization, activity auditing, and identity propagation via agent tool-call hooks (or wrapping tool execute). Built on @ory/argus.",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -29,8 +33,8 @@
     "permissions"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.9"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.0"
   },
   "devDependencies": {
     "typescript": "^6.0.2",